// Authentik OIDC access token claims we care about.
// Full set of claims is larger — only typing what we read.
export interface AuthentikJwtPayload {
  iss: string
  sub: string
  aud: string | string[]
  exp: number
  iat: number
  jti?: string

  // User info (populated when 'profile' + 'email' scopes are requested)
  email?: string
  email_verified?: boolean
  name?: string
  given_name?: string
  preferred_username?: string

  // Authentik groups the user belongs to — we model tenants as groups.
  groups?: string[]
}
